From Fred Fierling via https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5395 :

The ZigBee security dissector was not recording the short to long address
mappings in Security Headers, preventing the decryption of some payloads. This
patch eliminates the Undecoded warnings in packets 1 and 19 in this test
capture: https://bugs.wireshark.org/bugzilla/attachment.cgi?id=5457

The keys to decrypt these packets are listed in the bug.

svn path=/trunk/; revision=34886

5 files changed, 74 insertions, 75 deletions

diff --git a/epan/dissectors/packet-ieee802154.c b/epan/dissectors/packet-ieee802154.c
index 000e92448d..7e5fd870d8 100644
--- a/epan/dissectors/packet-ieee802154.c
+++ b/epan/dissectors/packet-ieee802154.c
@@ -107,12 +107,13 @@ static gboolean ieee802154_fcs_ok = TRUE;
 static const gchar *ieee802154_key_str = NULL;
 static gboolean     ieee802154_key_valid;
 static guint8       ieee802154_key[IEEE802154_CIPHER_SIZE];
+static const char  *ieee802154_user = "User";
 
 /*-------------------------------------
  * Address Hash Tables
  *-------------------------------------
  */
-static ieee802154_addr_t ieee802154_addr = { 0, NULL, NULL };
+static ieee802154_map_tab_t ieee802154_map = { NULL, NULL };
 
 /*-------------------------------------
  * Static Address Mapping UAT
@@ -680,7 +681,7 @@ dissect_ieee802154_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, g
     pd_save = pinfo->private_data;
     pinfo->private_data = packet;
 
-    packet->short_table = ieee802154_addr.short_table;
+    packet->short_table = ieee802154_map.short_table;
 
     /* Allocate frame data with hints for upper layers */
     if(!pinfo->fd->flags.visited){
@@ -859,7 +860,7 @@ dissect_ieee802154_common(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree, g
                 if (ieee_hints) {
                     ieee_hints->src16 = packet->src16;
                     ieee_hints->map_rec = (ieee802154_map_rec *)
-                        g_hash_table_lookup(ieee802154_addr.short_table, &addr16);
+                        g_hash_table_lookup(ieee802154_map.short_table, &addr16);
                 }
             }
         }
@@ -1597,8 +1598,8 @@ dissect_ieee802154_assoc_rsp(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree
 
     /* Update the address table. */
     if ((status == IEEE802154_CMD_ASRSP_AS_SUCCESS) && (short_addr != IEEE802154_NO_ADDR16)) {
-        ieee802154_addr_update(&ieee802154_addr, short_addr, packet->dst_pan, packet->dst64,
-                proto_ieee802154, pinfo->fd->num);
+        ieee802154_addr_update(&ieee802154_map, short_addr, packet->dst_pan, packet->dst64,
+                pinfo->current_proto, pinfo->fd->num);
     }
 
     /* Call the data dissector for any leftover bytes. */
@@ -1729,8 +1730,8 @@ dissect_ieee802154_realign(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
     offset += 2;
     /* Update the address table. */
     if ((short_addr != IEEE802154_NO_ADDR16) && (packet->dst_addr_mode == IEEE802154_FCF_ADDR_EXT)) {
-        ieee802154_addr_update(&ieee802154_addr, short_addr, packet->dst_pan, packet->dst64,
-                proto_ieee802154, pinfo->fd->num);
+        ieee802154_addr_update(&ieee802154_map, short_addr, packet->dst_pan, packet->dst64,
+                pinfo->current_proto, pinfo->fd->num);
     }
 
     /* Get and display the channel page, if it exists. Added in IEEE802.15.4-2006 */
@@ -2246,20 +2247,20 @@ gboolean ieee802154_long_addr_equal(gconstpointer a, gconstpointer b)
  *      ieee802154_addr_update
  *  DESCRIPTION
  *      Creates a record that maps the given short address and pan
- *      to a long (extended) address. Typically called when a
- *      successful association reponse is received.
+ *      to a long (extended) address.
  *  PARAMETERS
  *      guint16 short_addr  - 16-bit short address
  *      guint16 pan         - 16-bit PAN id
  *      guint64 long_addr   - 64-bit long (extended) address
+ *      const char *        - Pointer to name of current protocol
  *      guint               - Frame number this mapping became valid
  *  RETURNS
  *      TRUE                - Record was updated
  *      FALSE               - Couldn't find it
  *---------------------------------------------------------------
  */
-ieee802154_map_rec *ieee802154_addr_update(ieee802154_addr_t *ieee802154_addr,
-        guint16 short_addr, guint16 pan, guint64 long_addr, int proto, guint fnum)
+ieee802154_map_rec *ieee802154_addr_update(ieee802154_map_tab_t *ieee802154_map,
+        guint16 short_addr, guint16 pan, guint64 long_addr, const char *proto, guint fnum)
 {
     ieee802154_short_addr   addr16;
     ieee802154_map_rec     *p_map_rec;
@@ -2268,7 +2269,7 @@ ieee802154_map_rec *ieee802154_addr_update(ieee802154_addr_t *ieee802154_addr,
     /* Look up short address hash */
     addr16.pan = pan;
     addr16.addr = short_addr;
-    p_map_rec = g_hash_table_lookup(ieee802154_addr->short_table, &addr16);
+    p_map_rec = g_hash_table_lookup(ieee802154_map->short_table, &addr16);
 
     /* Update mapping record */
     if (p_map_rec) {
@@ -2291,20 +2292,20 @@ ieee802154_map_rec *ieee802154_addr_update(ieee802154_addr_t *ieee802154_addr,
     p_map_rec->addr64 = long_addr;
 
     /* link new mapping record to addr hash tables */
-    if ( g_hash_table_lookup_extended(ieee802154_addr->short_table, &addr16, &old_key, NULL) ) {
+    if ( g_hash_table_lookup_extended(ieee802154_map->short_table, &addr16, &old_key, NULL) ) {
         /* update short addr hash table, reusing pointer to old key */
-        g_hash_table_insert(ieee802154_addr->short_table, &old_key, p_map_rec);
+        g_hash_table_insert(ieee802154_map->short_table, &old_key, p_map_rec);
     } else {
         /* create new hash entry */
-        g_hash_table_insert(ieee802154_addr->short_table, se_memdup(&addr16, sizeof(addr16)), p_map_rec);
+        g_hash_table_insert(ieee802154_map->short_table, se_memdup(&addr16, sizeof(addr16)), p_map_rec);
     }
 
-    if ( g_hash_table_lookup_extended(ieee802154_addr->long_table, &long_addr, &old_key, NULL) ) {
+    if ( g_hash_table_lookup_extended(ieee802154_map->long_table, &long_addr, &old_key, NULL) ) {
         /* update long addr hash table, reusing pointer to old key */
-        g_hash_table_insert(ieee802154_addr->long_table, &old_key, p_map_rec);
+        g_hash_table_insert(ieee802154_map->long_table, &old_key, p_map_rec);
     } else {
         /* create new hash entry */
-        g_hash_table_insert(ieee802154_addr->long_table, se_memdup(&long_addr, sizeof(long_addr)), p_map_rec);
+        g_hash_table_insert(ieee802154_map->long_table, se_memdup(&long_addr, sizeof(long_addr)), p_map_rec);
     }
 
     return p_map_rec;
@@ -2333,8 +2334,8 @@ gboolean ieee802154_short_addr_invalidate(guint16 short_addr, guint16 pan, guint
 
     addr16.pan = pan;
     addr16.addr = short_addr;
- 
-    map_rec = g_hash_table_lookup(ieee802154_addr.short_table, &addr16);
+
+    map_rec = g_hash_table_lookup(ieee802154_map.short_table, &addr16);
     if ( map_rec ) {
         /* indicates this mapping is invalid at frame fnum */
         map_rec->end_fnum = fnum;
@@ -2363,7 +2364,7 @@ gboolean ieee802154_long_addr_invalidate(guint64 long_addr, guint fnum)
 {
     ieee802154_map_rec   *map_rec;
 
-    map_rec = g_hash_table_lookup(ieee802154_addr.long_table, &long_addr);
+    map_rec = g_hash_table_lookup(ieee802154_map.long_table, &long_addr);
     if ( map_rec ) {
         /* indicates this mapping is invalid at frame fnum */
         map_rec->end_fnum = fnum;
@@ -2423,7 +2424,7 @@ void proto_register_ieee802154(void)
             NULL, HFILL }},
 
         { &hf_ieee802154_nonask_phy_length,
-        { "Frame Length",                   "wpan-nonask-phy.frame_length", FT_UINT8, BASE_HEX, NULL, 
+        { "Frame Length",                   "wpan-nonask-phy.frame_length", FT_UINT8, BASE_HEX, NULL,
             IEEE802154_PHY_LENGTH_MASK, NULL, HFILL }},
     };
 
@@ -2831,15 +2832,15 @@ proto_init_ieee802154(void)
     guint       i;
 
     /* Destroy hash tables, if they exist. */
-    if (ieee802154_addr.short_table) g_hash_table_destroy(ieee802154_addr.short_table);
-    if (ieee802154_addr.long_table) g_hash_table_destroy(ieee802154_addr.long_table);
+    if (ieee802154_map.short_table) g_hash_table_destroy(ieee802154_map.short_table);
+    if (ieee802154_map.long_table) g_hash_table_destroy(ieee802154_map.long_table);
 
     /* Create the hash tables. */
-    ieee802154_addr.short_table = g_hash_table_new(ieee802154_short_addr_hash, ieee802154_short_addr_equal);
-    ieee802154_addr.long_table = g_hash_table_new(ieee802154_long_addr_hash, ieee802154_long_addr_equal);
+    ieee802154_map.short_table = g_hash_table_new(ieee802154_short_addr_hash, ieee802154_short_addr_equal);
+    ieee802154_map.long_table = g_hash_table_new(ieee802154_long_addr_hash, ieee802154_long_addr_equal);
     /* Re-load the hash table from the static address UAT. */
     for (i=0; (i<num_static_addrs) && (static_addrs); i++) {
-        ieee802154_addr_update(&ieee802154_addr,(guint16)static_addrs[i].addr16, (guint16)static_addrs[i].pan,
-               pntoh64(static_addrs[i].eui64), proto_ieee802154, IEEE802154_USER_MAPPING);
+        ieee802154_addr_update(&ieee802154_map,(guint16)static_addrs[i].addr16, (guint16)static_addrs[i].pan,
+               pntoh64(static_addrs[i].eui64), ieee802154_user, IEEE802154_USER_MAPPING);
     } /* for */
 } /* proto_init_ieee802154 */
diff --git a/epan/dissectors/packet-ieee802154.h b/epan/dissectors/packet-ieee802154.h
index c8a9ada6c6..ab7b999b93 100644
--- a/epan/dissectors/packet-ieee802154.h
+++ b/epan/dissectors/packet-ieee802154.h
@@ -204,11 +204,11 @@ typedef struct {
     GHashTable *short_table;
 } ieee802154_packet;
 
+/* Structure for two-way mapping table */
 typedef struct {
-    guint       proto;
     GHashTable *long_table;
     GHashTable *short_table;
-} ieee802154_addr_t;
+} ieee802154_map_tab_t;
 
 /* Key used by the short address hash table. */
 typedef struct {
@@ -223,7 +223,7 @@ typedef struct {
 
 /* A mapping record for a frame, pointed to by hash table */
 typedef struct {
-    int         proto; /* protocol that created this record */
+    const char *proto; /* name of protocol that created this record */
     guint       start_fnum;
     guint       end_fnum;
     guint64     addr64;
@@ -244,7 +244,8 @@ extern gchar       *print_eui64_oui(guint64);
 extern proto_item  *proto_tree_add_eui64(proto_tree *, int, tvbuff_t *, gint, gint, gint64);
 
 /* Short to Extended Address Prototypes */
-extern ieee802154_map_rec *ieee802154_addr_update(ieee802154_addr_t *, guint16, guint16, guint64, int, guint);
+extern ieee802154_map_rec *ieee802154_addr_update(ieee802154_map_tab_t *, guint16, guint16, guint64,
+        const char *, guint);
 extern guint    ieee802154_short_addr_hash(gconstpointer);
 extern guint    ieee802154_long_addr_hash(gconstpointer key);
 extern gboolean ieee802154_short_addr_equal(gconstpointer, gconstpointer);
diff --git a/epan/dissectors/packet-zbee-nwk.c b/epan/dissectors/packet-zbee-nwk.c
index 1b64099e04..4506641f6c 100644
--- a/epan/dissectors/packet-zbee-nwk.c
+++ b/epan/dissectors/packet-zbee-nwk.c
@@ -256,7 +256,7 @@ static const value_string zbee_nwk_stack_profiles[] = {
  * Hash Tables and Lists
  *-------------------------------------
  */
-static ieee802154_addr_t zbee_nwk_addr = { 0, NULL, NULL };
+ieee802154_map_tab_t zbee_nwk_map = { NULL, NULL };
 GHashTable *zbee_table_nwk_keyring = NULL;
 GHashTable *zbee_table_link_keyring = NULL;
 
@@ -386,7 +386,7 @@ dissect_zbee_nwk(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
     col_set_str(pinfo->cinfo, COL_PROTOCOL, "ZigBee");
     col_clear(pinfo->cinfo, COL_INFO);
     if (tree) {
-        proto_root = proto_tree_add_protocol_format(tree, proto_zbee_nwk, tvb, offset, 
+        proto_root = proto_tree_add_protocol_format(tree, proto_zbee_nwk, tvb, offset,
                                                     tvb_length(tvb), "ZigBee Network Layer");
         nwk_tree = proto_item_add_subtree(proto_root, ett_zbee_nwk);
     }
@@ -409,7 +409,7 @@ dissect_zbee_nwk(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
         ti = proto_tree_add_text(nwk_tree, tvb, offset, 2, "Frame Control Field: %s (0x%04x)",
                 val_to_str(packet.type, zbee_nwk_frame_types, "Unknown"), fcf);
         field_tree = proto_item_add_subtree(ti, ett_zbee_nwk_fcf);
-        proto_tree_add_uint(field_tree, hf_zbee_nwk_frame_type, tvb, offset, 1, 
+        proto_tree_add_uint(field_tree, hf_zbee_nwk_frame_type, tvb, offset, 1,
                             fcf & ZBEE_NWK_FCF_FRAME_TYPE);
 
         /*  Add the rest of the fcf fields to the subtree */
@@ -424,11 +424,11 @@ dissect_zbee_nwk(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
         proto_tree_add_boolean(field_tree, hf_zbee_nwk_security, tvb, offset+1,
                             1, fcf & ZBEE_NWK_FCF_SECURITY);
         if (pinfo->zbee_stack_vers >= ZBEE_VERSION_2007) {
-            proto_tree_add_boolean(field_tree, hf_zbee_nwk_source_route, tvb, offset+1, 
+            proto_tree_add_boolean(field_tree, hf_zbee_nwk_source_route, tvb, offset+1,
                             1, fcf & ZBEE_NWK_FCF_SOURCE_ROUTE);
-            proto_tree_add_boolean(field_tree, hf_zbee_nwk_ext_dst, tvb, offset+1, 
+            proto_tree_add_boolean(field_tree, hf_zbee_nwk_ext_dst, tvb, offset+1,
                             1, fcf & ZBEE_NWK_FCF_EXT_DEST);
-            proto_tree_add_boolean(field_tree, hf_zbee_nwk_ext_src, tvb, offset+1, 
+            proto_tree_add_boolean(field_tree, hf_zbee_nwk_ext_src, tvb, offset+1,
                             1, fcf & ZBEE_NWK_FCF_EXT_SOURCE);
         }
     }
@@ -466,8 +466,9 @@ dissect_zbee_nwk(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
     col_append_fstr(pinfo->cinfo, COL_INFO, ", Dst: %s", dst_addr);
 
 
-    /* Get the short nwk source address. */
+    /* Get the short nwk source address and pass it to upper layers */
     packet.src = tvb_get_letohs(tvb, offset);
+    if (nwk_hints) nwk_hints->src = packet.src;
     if (tree) {
         proto_tree_add_uint(nwk_tree, hf_zbee_nwk_src, tvb, offset, 2, packet.src);
     }
@@ -520,11 +521,11 @@ dissect_zbee_nwk(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
             ti = proto_tree_add_text(nwk_tree, tvb, offset, 1, "Multicast Control Field");
             field_tree = proto_item_add_subtree(ti, ett_zbee_nwk_mcast);
             /* Add the fields. */
-            ti = proto_tree_add_uint(field_tree, hf_zbee_nwk_mcast_mode, tvb, offset, 1, 
+            ti = proto_tree_add_uint(field_tree, hf_zbee_nwk_mcast_mode, tvb, offset, 1,
                                     mcast_control & ZBEE_NWK_MCAST_MODE);
-            proto_tree_add_uint(field_tree, hf_zbee_nwk_mcast_radius, tvb, offset, 1, 
+            proto_tree_add_uint(field_tree, hf_zbee_nwk_mcast_radius, tvb, offset, 1,
                                     mcast_control & ZBEE_NWK_MCAST_RADIUS);
-            proto_tree_add_uint(field_tree, hf_zbee_nwk_mcast_max_radius, tvb, offset, 1, 
+            proto_tree_add_uint(field_tree, hf_zbee_nwk_mcast_max_radius, tvb, offset, 1,
                                     mcast_control & ZBEE_NWK_MCAST_MAX_RADIUS);
         }
         offset += 1;
@@ -556,8 +557,8 @@ dissect_zbee_nwk(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
 
                 /* Update nwk extended address hash table */
                 if ( unicast_src ) {
-                    nwk_hints->map_rec = ieee802154_addr_update(&zbee_nwk_addr,
-                            packet.src, addr16.pan, packet.src64, proto_zbee_nwk, pinfo->fd->num);
+                    nwk_hints->map_rec = ieee802154_addr_update(&zbee_nwk_map,
+                            packet.src, addr16.pan, packet.src64, pinfo->current_proto, pinfo->fd->num);
                 }
             }
         }
@@ -567,7 +568,7 @@ dissect_zbee_nwk(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
                 nwk_hints->src_pan = ieee_packet->src_pan;
                 addr16.addr = packet.src;
 
-                map_rec = (ieee802154_map_rec *) g_hash_table_lookup(zbee_nwk_addr.short_table, &addr16);
+                map_rec = (ieee802154_map_rec *) g_hash_table_lookup(zbee_nwk_map.short_table, &addr16);
                 if (map_rec) {
                     /* found a nwk mapping record */
                     nwk_hints->map_rec = map_rec;
@@ -577,7 +578,7 @@ dissect_zbee_nwk(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
                     map_rec = (ieee802154_map_rec *) g_hash_table_lookup(ieee_packet->short_table, &addr16);
                     if (map_rec) nwk_hints->map_rec = map_rec;
                 }
-            } /* (!pinfo->fd->flags.visited) */ 
+            } /* (!pinfo->fd->flags.visited) */
             else {
                 if (tree && nwk_hints && nwk_hints->map_rec ) {
                     /* Display inferred source address info */
@@ -603,7 +604,7 @@ dissect_zbee_nwk(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree)
                     ieee_hints && !ieee_hints->map_rec ) {
                 addr16.pan = ieee_packet->src_pan;
                 addr16.addr = ieee_packet->src16;
-                map_rec = (ieee802154_map_rec *) g_hash_table_lookup(zbee_nwk_addr.short_table, &addr16);
+                map_rec = (ieee802154_map_rec *) g_hash_table_lookup(zbee_nwk_map.short_table, &addr16);
 
                 if (map_rec) {
                     /* found a ieee mapping record */
@@ -729,7 +730,7 @@ static void dissect_zbee_nwk_cmd(tvbuff_t *tvb, packet_info *pinfo, proto_tree *
 
     /* Create a subtree for this command. */
     if (tree) {
-        cmd_root = proto_tree_add_text(tree, tvb, offset, tvb_length(tvb), "Command Frame: %s", 
+        cmd_root = proto_tree_add_text(tree, tvb, offset, tvb_length(tvb), "Command Frame: %s",
                                         val_to_str(cmd_id, zbee_nwk_cmd_names, "Unknown"));
         cmd_tree = proto_item_add_subtree(cmd_root, ett_zbee_nwk_cmd);
 
@@ -852,15 +853,15 @@ dissect_zbee_nwk_route_req(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
         field_tree = proto_item_add_subtree(ti, ett_zbee_nwk_cmd_options);
 
         if (pinfo->zbee_stack_vers >= ZBEE_VERSION_2007) {
-            proto_tree_add_boolean(field_tree, hf_zbee_nwk_cmd_route_opt_multicast, tvb, offset, 
+            proto_tree_add_boolean(field_tree, hf_zbee_nwk_cmd_route_opt_multicast, tvb, offset,
                                     1, route_options & ZBEE_NWK_CMD_ROUTE_OPTION_MCAST);
-            proto_tree_add_boolean(field_tree, hf_zbee_nwk_cmd_route_opt_dest_ext, tvb, offset, 
+            proto_tree_add_boolean(field_tree, hf_zbee_nwk_cmd_route_opt_dest_ext, tvb, offset,
                                     1, route_options & ZBEE_NWK_CMD_ROUTE_OPTION_DEST_EXT);
-            proto_tree_add_uint(field_tree, hf_zbee_nwk_cmd_route_opt_many_to_one, tvb, offset, 
+            proto_tree_add_uint(field_tree, hf_zbee_nwk_cmd_route_opt_many_to_one, tvb, offset,
                                     1, route_options & ZBEE_NWK_CMD_ROUTE_OPTION_MANY_MASK);
         }
         else {
-            proto_tree_add_boolean(tree, hf_zbee_nwk_cmd_route_opt_repair, tvb, offset, 1, 
+            proto_tree_add_boolean(tree, hf_zbee_nwk_cmd_route_opt_repair, tvb, offset, 1,
                                     route_options & ZBEE_NWK_CMD_ROUTE_OPTION_REPAIR);
         }
     }
@@ -1154,17 +1155,17 @@ dissect_zbee_nwk_rejoin_req(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree,
         field_tree = proto_item_add_subtree(ti, ett_zbee_nwk_cmd_cinfo);
 
         /* Add the capability info flags. */
-        proto_tree_add_boolean(field_tree, hf_zbee_nwk_cmd_cinfo_alt_coord, tvb, offset, 1, 
+        proto_tree_add_boolean(field_tree, hf_zbee_nwk_cmd_cinfo_alt_coord, tvb, offset, 1,
                                 capabilities & ZBEE_CINFO_ALT_COORD);
-        proto_tree_add_boolean(field_tree, hf_zbee_nwk_cmd_cinfo_type, tvb, offset, 1, 
+        proto_tree_add_boolean(field_tree, hf_zbee_nwk_cmd_cinfo_type, tvb, offset, 1,
                                 capabilities & ZBEE_CINFO_FFD);
-        proto_tree_add_boolean(field_tree, hf_zbee_nwk_cmd_cinfo_power, tvb, offset, 1, 
+        proto_tree_add_boolean(field_tree, hf_zbee_nwk_cmd_cinfo_power, tvb, offset, 1,
                                 capabilities & ZBEE_CINFO_POWER);
-        proto_tree_add_boolean(field_tree, hf_zbee_nwk_cmd_cinfo_idle_rx, tvb, offset, 1, 
+        proto_tree_add_boolean(field_tree, hf_zbee_nwk_cmd_cinfo_idle_rx, tvb, offset, 1,
                                 capabilities & ZBEE_CINFO_IDLE_RX);
-        proto_tree_add_boolean(field_tree, hf_zbee_nwk_cmd_cinfo_security, tvb, offset, 1, 
+        proto_tree_add_boolean(field_tree, hf_zbee_nwk_cmd_cinfo_security, tvb, offset, 1,
                                 capabilities & ZBEE_CINFO_SECURITY);
-        proto_tree_add_boolean(field_tree, hf_zbee_nwk_cmd_cinfo_alloc, tvb, offset, 1, 
+        proto_tree_add_boolean(field_tree, hf_zbee_nwk_cmd_cinfo_alloc, tvb, offset, 1,
                                 capabilities & ZBEE_CINFO_ALLOC);
     }
     offset += 1;
@@ -1613,7 +1614,7 @@ void proto_register_zbee_nwk(void)
             { &hf_zbee_nwk_src64,
             { "Extended Source",        "zbee.nwk.src64", FT_UINT64, BASE_HEX, NULL, 0x0,
                 NULL, HFILL }},
-            
+
             { &hf_zbee_nwk_src64_origin,
             { "Origin",        "zbee.nwk.src64.origin", FT_FRAMENUM, BASE_NONE, NULL, 0x0,
                 NULL, HFILL }},
@@ -1898,12 +1899,12 @@ static void
 proto_init_zbee_nwk(void)
 {
     /* Destroy the hash tables, if they exist. */
-    if (zbee_nwk_addr.short_table) g_hash_table_destroy(zbee_nwk_addr.short_table);
-    if (zbee_nwk_addr.long_table) g_hash_table_destroy(zbee_nwk_addr.long_table);
+    if (zbee_nwk_map.short_table) g_hash_table_destroy(zbee_nwk_map.short_table);
+    if (zbee_nwk_map.long_table) g_hash_table_destroy(zbee_nwk_map.long_table);
     if (zbee_table_nwk_keyring) g_hash_table_destroy(zbee_table_nwk_keyring);
 
     /* (Re)create the hash tables. */
-    zbee_nwk_addr.short_table = g_hash_table_new(ieee802154_short_addr_hash, ieee802154_short_addr_equal);
-    zbee_nwk_addr.long_table = g_hash_table_new(ieee802154_long_addr_hash, ieee802154_long_addr_equal);
+    zbee_nwk_map.short_table = g_hash_table_new(ieee802154_short_addr_hash, ieee802154_short_addr_equal);
+    zbee_nwk_map.long_table = g_hash_table_new(ieee802154_long_addr_hash, ieee802154_long_addr_equal);
     zbee_table_nwk_keyring  = g_hash_table_new_full(g_int_hash, g_int_equal, NULL, free_keyring_val);
 } /* proto_init_zbee_nwk */
diff --git a/epan/dissectors/packet-zbee-nwk.h b/epan/dissectors/packet-zbee-nwk.h
index 9069e83961..19e42d739c 100644
--- a/epan/dissectors/packet-zbee-nwk.h
+++ b/epan/dissectors/packet-zbee-nwk.h
@@ -164,12 +164,14 @@ typedef struct {
 
 typedef struct {
     gint                    src_pan;        /* source pan */
+    gint                    src;           /* short source address from nwk */
     gint                    ieee_src;       /* short source address from mac */
     ieee802154_map_rec     *map_rec;    /* extended src from nwk */
     key_record_t           *nwk;            /* Network key found for this packet */
     key_record_t           *link;           /* Link key found for this packet */
 } zbee_nwk_hints_t;
 
+extern ieee802154_map_tab_t zbee_nwk_map;
 extern GHashTable *zbee_table_nwk_keyring;
 extern GHashTable *zbee_table_link_keyring;
 
diff --git a/epan/dissectors/packet-zbee-security.c b/epan/dissectors/packet-zbee-security.c
index 3bf0fb1b2f..c70a7a4436 100644
--- a/epan/dissectors/packet-zbee-security.c
+++ b/epan/dissectors/packet-zbee-security.c
@@ -65,9 +65,6 @@ static gboolean    zbee_security_parse_key(const gchar *, guint8 *, gboolean);
 static void proto_init_zbee_security(void);
 
 /* Field pointers. */
-#if 0
-static int hf_zbee_sec_level = -1;
-#endif
 static int hf_zbee_sec_key_id = -1;
 static int hf_zbee_sec_nonce = -1;
 static int hf_zbee_sec_counter = -1;
@@ -217,11 +214,6 @@ static GSList *zbee_pc_keyring = NULL;
 void zbee_security_register(module_t *zbee_prefs, int proto)
 {
     static hf_register_info hf[] = {
-#if 0
-            { &hf_zbee_sec_level,
-            { "Level",                  "zbee.sec.level", FT_UINT8, BASE_HEX, VALS(zbee_sec_level_names), ZBEE_SEC_CONTROL_LEVEL,
-                NULL, HFILL }},
-#endif
             { &hf_zbee_sec_key_id,
             { "Key Id",                    "zbee.sec.key", FT_UINT8, BASE_HEX, VALS(zbee_sec_key_names),
                 ZBEE_SEC_CONTROL_KEY, NULL, HFILL }},
@@ -440,10 +432,6 @@ dissect_zbee_secure(tvbuff_t *tvb, packet_info *pinfo, proto_tree* tree, guint o
 #ifdef HAVE_LIBGCRYPT
     guint8             *enc_buffer;
     guint8             *dec_buffer;
-#if 0
-    guint8              buffer[ZBEE_SEC_CONST_BLOCKSIZE+1];
-    guint8             *key_buffer = buffer;
-#endif
     gboolean            decrypted;
     GSList            **nwk_keyring;
     GSList             *GSList_i;
@@ -517,6 +505,12 @@ dissect_zbee_secure(tvbuff_t *tvb, packet_info *pinfo, proto_tree* tree, guint o
         if (tree) {
             proto_tree_add_eui64(sec_tree, hf_zbee_sec_src64, tvb, offset, 8, packet.src64);
         }
+
+        if (!pinfo->fd->flags.visited && nwk_hints && ieee_hints ) {
+            /* record this mapping */
+            nwk_hints->map_rec = ieee802154_addr_update(&zbee_nwk_map, nwk_hints->src,
+                    ieee_hints->src_pan, packet.src64, pinfo->current_proto, pinfo->fd->num);
+        }
         offset += 8;
     }
     else {